I double-checked for the setting you mentioned. However, the Graylog OVA is missing these rotation settings. There may be other missing settings, it might be worth finding out why the OVA conf file doesn't match the default conf file.
ubuntu@graylog:/opt/graylog/conf$ grep rotation graylog.conf # Disable message retention on this node, i. e. disable Elasticsearch index rotation. ubuntu@graylog:/opt/graylog/conf$ grep rotation_strategy graylog.conf ubuntu@graylog:/opt/graylog/conf$ I created an issue for this: https://github.com/Graylog2/graylog2-images/issues/47 Thanks! Tristan On Sat, Mar 7, 2015 at 8:38 AM, Kay Röpke <[email protected]> wrote: > Look for rotation, not retention. > > There's a rotation_strategy entry. Have a look at > https://github.com/Graylog2/graylog2-server/blob/master/misc/graylog2.conf > > Cheers! > On Mar 7, 2015 4:34 PM, "Tristan Rhodes" <[email protected]> wrote: > >> I noticed this was missing also. It is possible that the settings are >> missing by default, but they would work if added manually. (I don't >> have the right syntax with me). >> >> On Friday, March 6, 2015, Francois Franck <[email protected]> wrote: >> >>> Hi all, >>> >>> I've heard about a time-based retention policy to rotate indices but I >>> can't find such a policy in *Graylog v1.0*. >>> Here what my */opt/graylog/graylog.conf* looks like >>> >>> ... >>> elasticsearch_max_docs_per_index = 20000000 >>> # Disable message retention on this node, i. e. disable Elasticsearch >>> index rotation. >>> #no_retention = false >>> elasticsearch_max_number_of_indices = 20 >>> # Decide what happens with the oldest indices when the maximum number of >>> indices is reached. >>> # The following strategies are availble: >>> # - delete # Deletes the index completely (Default) >>> # - close # Closes the index and hides it from the system. Can be >>> re-opened later. >>> retention_strategy = delete >>> ... >>> >>> >>> Did I miss something ? >>> Can someone tell me how to configure Gralog to keep logs for around 1 >>> year before rotate ? >>> Thanks. >>> >>> >>> -- >>> You received this message because you are subscribed to the Google >>> Groups "graylog2" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to [email protected]. >>> For more options, visit https://groups.google.com/d/optout. >>> >> >> >> -- >> Tristan Rhodes >> >> -- >> You received this message because you are subscribed to the Google Groups >> "graylog2" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/d/optout. >> > -- > You received this message because you are subscribed to the Google Groups > "graylog2" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- Tristan Rhodes -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
